EUVD-2026-50714
GHSA-gxjg-hhh8-vmc7
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC elevated to H because renderer process compromise is an explicit prerequisite, making attack conditions substantially complex despite network delivery of the final crafted page.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's WebProtect component (prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by loading a crafted HTML page. The flaw stems from an inappropriate implementation of origin validation (CWE-346), allowing WebProtect to fail its primary function of enforcing same-origin boundaries within Chrome's sandboxed renderer. No active exploitation has been confirmed by CISA KEV, no public POC has been identified, and EPSS at 0.21% (11th percentile) indicates low near-term exploitation probability - though this vulnerability's relevance as a component in chained browser exploit chains elevates its strategic significance beyond the raw score.
Technical ContextAI
WebProtect is a security subsystem within Google Chrome's multi-process architecture designed to enforce same-origin policy boundaries and isolate cross-origin data between renderer contexts. CWE-346 (Origin Validation Error) identifies the root cause class: the component fails to properly validate origin identity, permitting data from one origin to be accessed or leaked to another. Chrome's architecture places rendering in isolated processes (the renderer), which are supposed to be constrained from accessing cross-origin resources even if compromised - WebProtect is one enforcement layer in this model. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all desktop Chrome versions prior to 151.0.7922.72 across Windows, macOS, and Linux. The vulnerability specifically requires a compromised renderer as a prerequisite, meaning it functions as a security bypass within an already partially-breached process context, not as an initial access vector.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later using the browser's built-in update mechanism or via the vendor's Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. The vendor has confirmed patch availability. Because exploitation requires a pre-compromised renderer process, organizations that cannot immediately patch should verify that Chrome's Site Isolation (--site-per-process) is enforced via enterprise policy, as this limits cross-origin data access from a compromised renderer and reduces the exploitability of this flaw specifically. Restricting access to sensitive internal web applications to managed, patched browsers reduces the blast radius if a renderer compromise occurs. No workaround fully mitigates the origin validation flaw without applying the patch; compensating controls address the prerequisite renderer compromise rather than this CVE directly.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today